For each of the 34 roles (3 clients, 9 bots, 22 bridges), this commit:
- Adds `_restart_necessary: false` default variable
- Adds `register:` directives to config/image/systemd tasks
- Computes `_restart_necessary` via set_fact (OR of all .changed results)
- Wires `(_restart_necessary | bool)` in group_vars/matrix_servers

This allows the systemd service manager to skip unnecessary restarts
when running install-* tags and nothing actually changed.

Service roles and complex multi-service roles will follow separately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

These variables track whether a database migration necessitates a service
restart. The new name avoids confusion with the conditional restart
feature introduced in af193043/9accc848/4a8df138, where
devture_systemd_service_manager handles restarting services whose
configuration or image changed. The old _requires_restart name was
ambiguous — it could be mistaken for the systemd_service_manager
mechanism — so _migration_requires_restart makes the purpose explicit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Documentation update

* New files for role

* Update existing files to add support for matrix-steam-bridge

* Typos and misc fixes

* Change docker tag to latest until version # is stable

* Align bridge permissions

* Correct user localpart

* Remove trailing +

* Fix syslog identifier

* Actually enable the service correctly

* One more typo fix

* Third time's the charm

* Fix config file paths

* Fix config after bridge repo changes

* Add default appservice public address - set public_media to false by default for testing

* Fix default config for steamkit-service path

* Fix bluesky reference

* Fix default container path

* Fix appservice connection to http for internal, change port to standard 8080

* Fix appservice port

* Enable public_media by default, add labels

* Enable public_media by default, add labels

* Allow bridge to update its own config and generate public_media signing key

* Add deterministic public_media_signing_key, expose portal cleanup

* Change default public_media path to omit `matrix.` from the path as it has been found that URLs generated by the bridge will only match {{ matrix_domain }}

* Remove domain re-write

* Revert "Change default public_media path to omit `matrix.` from the path as it has been found that URLs generated by the bridge will only match {{ matrix_domain }}"

This reverts commit 5f399effb9.

* Fix TLS label if playbook TLS is disabled

* Match default bridge TLS config

* Related to 3daf14d69 and 60ab08014 which enable async media by default for mautrix-go bridges

* Adjust matrix-bridge-steam files to add new line at the end of files

* Pin matrix-bridge-steam (latest -> 1.0.3)

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>